Flow statistics collection in the NSP

Introduction

The NSP can collect flow statistics from managed NEs. Although other criteria may apply, a flow is basically a series of IP packets that share a common source, destination, and type of payload, for example, traffic that is specific to an application.

When an NE is configured to collect flow statistics, the NE monitors the traffic on one or more interfaces to identify the flows, aggregates the flow data, and regularly exports flow data records to an external system.

The NSP uses NSP Flow Collectors to collect the following flow statistics from managed NEs:

• IPFIX v10 (RFC 7011), with the following Nokia variants:

  • System Cflowd

  • CGNAT

• Netflow v5

Note: CGNAT support remains restricted to the 7750 SR, for Format 1 and Format 2 CSV records only. See Flow statistics.

Note: For information about using NFM-P to collect IPFIX v10 statistics with the AA Cflowd Nokia variant, see the NFM-P Statistics Management Guide.

Functional description

IPFIX data is sent from routers, packaged in IPFIX messages that contain IPFIX records. Each record is a collection of fields determined by an IPFIX template. These templates are periodically sent by the routers to the collectors. IPFIX templates can be modified (fields can be removed from or added to the records). A flow collector uses these templates to decode the IPFIX records.

The fields contained in a record may include - but are not limited to - the following:

• counters

• timestamps

• delays

• quantities

• labels

• IDs

The Flow Collector generates "data types" using sets of counters that are found in IPFIX records and/or values computed based on IPFIX records. The Flow Collector collects these data types at configured intervals, then exports the collected data in various formats (IPDR binary files, CSV text files, Kafka notifications, Vertica database records).

Each data type can be aggregated in one or more ways by applying an "aggregation type" to it. Each aggregation type is defined by a set of fields from the IPFIX record (usually IDs) and, potentially, correlated information from the NFM-P database. When no aggregation is applied the Flow Collector refers to the data as "raw" (raw aggregation). During each interval, aggregated data is collected in a memory buffer, and is exported in one of the supported formats when the interval ends.

Collected data can be exported in the following formats:

• System Cflowd

  • Vertica database

• CGNAT

  • CSV text files

• Netflow v5

  • Vertica database